GitLab's biggest risks in the FY2025 10-K
- GitLab's risk profile centers on managing rapid growth, scaling profitability past historic net losses, and navigating competitive DevSecOps markets.
The risks most specific to GitLab
- Risks Related to Our Business and Financial Position
Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful
Our revenue was $759.2 million for fiscal year 2025 and $579.9 million for fiscal year 2024, and our past growth rate may not continue.
- Risks Related to Our Business and Financial Position
We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected
We have incurred net losses of $173.4 million, $425.7 million, and $6.3 million in fiscal years 2023, 2024, and 2025, respectively, with an accumulated deficit of $1.2 billion as of January 31, 2025.
- Risks Related to Our Business and Financial Position
Security and privacy breaches may hurt our business
The DevSecOps platform stores sensitive customer personal and financial data, exposing us to potential security and privacy breaches.
- Risks Related to Our Business and Financial Position
We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products
Our use of third-party open-source code in the DevSecOps platform creates supply-chain cybersecurity vulnerabilities.
- Risks Related to Our Business and Financial Position
The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations
Our GitLab Duo suite of AI features relies on early-stage technologies in a rapidly evolving regulatory environment.
- Risks Related to Our Business and Financial Position
The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business
Our publicly available company Handbook may be used by competitors or bad actors to harm our business and operations.
- Risks Related to Our Business and Financial Position
Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer
Users may continue using our free self-managed or SaaS product offerings instead of converting to paid subscriptions.
- Risks Related to Our Business and Financial Position
We are subject to various governmental export controls, trade sanctions, and import laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls
Our software is subject to U.S. Export Administration Regulations and Department of the Treasury economic sanctions.
- Risks Related to Our Business and Financial Position
Failure to comply with anti-bribery, anti-corruption, anti-money laundering laws, and similar laws, could subject us to penalties and other adverse consequences
We are subject to anti-corruption laws including the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010.
All 68 risk factors
Headings as the filing states them, in filing order.
Risks Related to Our Business and Financial Position
- 01Our business and operations have experienced rapid growth, and if we do not appropriately and effectively manage future growth, if any, or are unable to improve our systems, processes and controls, our business, financial condition, results of operations, and prospects will be adversely affected
- 02Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful
- 03and subject to a number of uncertainties, including our ability to plan for and model future growth. Our historical revenue growth should not be considered indicative of our future performance
- 04We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected
- 05Security and privacy breaches may hurt our business
- 06We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products
- 07We face intense competition and could lose market share to our competitors, which would adversely affect our business, operating results, and financial condition
- 08If our services fail to perform properly, whether due to material defects with the software or external issues, our reputation could be adversely affected, our market share could decline, and we could be subject to liability claims
- 09The costs incurred in correcting any material defects, software “bugs” or errors might be substantial and could adversely affect our operating results
- 10on streamlined processes made available through information systems, global communications, internet activity, and other network processes
- 11The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock
- 12Our operating results may fluctuate significantly, which could make our future results difficult to predict and could adversely affect the trading price of our Class A common stock
- 13As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us
- 14The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations
- 15Our generative AI features may also generate output that is misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability
- 16Transparency is one of our core values. While we will continue to prioritize transparency, we must also promote "responsible" transparency as transparency can have unintended negative consequences
- 17The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business
- 18Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer
- 19Failure to effectively expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our services
- 20Any failure to offer high-quality technical support services, including success plan services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results
- 21Customers may demand more customized configuration and integration services, or custom features and functions that we do not offer, which could adversely affect our business and operating results
- 22If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, and changing customer needs, requirements, or preferences, our services may become less competitive
- 23Our channel partners may provide a poor experience to customers putting our brand or company growth at risk. Channel partners may deliver poor services or a poor selling experience delaying customer purchase or hurting the company brand
- 24We track certain performance metrics with internal tools and data models and do not independently verify such metrics. Certain of our performance metrics are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and negatively affect our business
- 25We rely to a significant degree on a number of independent open source contributors, to develop and enhance the open source technologies we use to provide our products and services
- 26could cause our offerings to be less competitive, impair customer acceptance of our offerings and result in delayed or reduced revenue for our offerings
- 27We license many significant components of our software under permissive open source software licenses which grant licensees broad permissions to use, copy, modify, and distribute the covered software. Under these licenses, third parties are entitled to distribute and sell the covered software without payment to us
- 28We are or may be the defendant in lawsuits or other claims that could cause us to incur substantial liabilities
- 29We may engage in merger and acquisition activities and joint ventures, which could require significant management attention, disrupt our business, dilute stockholder value, and adversely affect our operating results
- 30If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected
- 31Adverse tax laws or regulations could be enacted or existing laws could be applied to us or our customers, which could increase the costs of our services and adversely impact our business
- 32The termination of our relationship with our payment solutions providers could have a severe, negative impact on our ability to collect revenue from customers
- 33We are subject to various governmental export controls, trade sanctions, and import laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls
- 34Failure to comply with anti-bribery, anti-corruption, anti-money laundering laws, and similar laws, could subject us to penalties and other adverse consequences
- 35A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks
- 36process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations
- 37Our success depends on our ability to provide users of our products and services with access to an abundance of useful, efficient, high-quality code which in turn depends on the quality and volume of code contributed by our open source contributors
- 38Seasonality may cause fluctuations in our sales and results of operations
- 39The length of our sales cycle can be unpredictable, particularly with respect to sales to large customers, and our sales efforts may require considerable time and expense
Risks Related to our People and Culture
- 40We rely on our management team and other key team members and will need additional personnel to grow our business, and the loss of one or more key team members or our inability to hire, integrate, train and retain qualified personnel, could harm our business
- 41Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity, and teamwork fostered by our culture, and our business may be harmed
- 42We engage our team members in various ways, including direct hires, through PEOs and as independent contractors. As a result of these methods of engagement, we face certain challenges and risks that can affect our business, operating results, and financial condition
- 43If we do not effectively hire, integrate, and train additional sales personnel, and expand our sales and marketing capabilities, we may be unable to increase our customer base and increase sales to our existing customers
- 44We are a remote-only company, meaning that our team members work remotely which poses a number of risks and challenges that can affect our business, operating results, and financial condition. We are highly dependent on technology in our operations and if our technology fails, our business could be adversely affected
- 45Unfavorable media coverage could negatively impact our business
- 46Our brand, reputation, and business may be harmed if our customers, partners, team members, contributors or the public at large disagrees with, or finds objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team
Risks Related to Our International Operations
- 47We plan to continue expanding our international operations which could subject us to additional costs and risks, and our continued expansion internationally may not be successful
- 48We have a limited operating history in China and we face risks with respect to conducting business in connection with our joint venture in China due to certain legal, political, economic and social uncertainties relating to China. Our ability to monetize our joint venture in China may be limited
- 49We are exposed to fluctuations in currency exchange rates and interest rates, which could negatively affect our results of operations and our ability to invest and hold our cash
Risks Related to Financial and Accounting Matters
- 50Failure to maintain effective systems of internal controls and disclosure controls could have a material adverse effect on our business, operating results, and financial condition
- 51As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market
- 52We incur significant costs and devote management resources as a result of operating as a public company
- 53We may in the future need to raise additional capital to grow our business, and we may not be able to raise capital on terms acceptable to us or at all. In addition, any inability to generate or obtain such capital may adversely affect our operating results and financial condition
- 54required to modify our growth and operating plans based on available funding, if any, which would harm our ability to grow our business
- 55Changes in tax laws or other tax guidance could adversely affect our effective tax rates, financial condition, and results of operations
- 56We may have exposure to greater than anticipated tax liabilities
- 57Our cash and cash equivalents could be adversely affected if the financial institutions in which we hold our cash and cash equivalents fail
Risks Related to Ownership of Our Class A Common Stock
- 58The market price of our Class A common stock may be volatile, and you could lose all or part of your investment
- 59Sales of substantial amounts of our Class A common stock in the public markets, or the perception that they might occur, could cause the market price of our Class A common stock to decline
- 60We may also issue our shares of our capital stock or securities convertible into shares of our capital stock from time to time in connection with a financing, acquisition, investment, or otherwise
- 61The dual class structure of our common stock may adversely affect the trading market for our Class A common stock
- 62If industry or financial analysts do not continue to publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our Class A common stock, our stock price and trading volume could decline
- 63We do not intend to pay dividends in the foreseeable future. As a result, your ability to achieve a return on your investment will depend on appreciation in the price of our Class A common stock
- 64Provisions in our organizational documents and under Delaware law could make an acquisition of us, which could be beneficial to our stockholders, more difficult and may limit attempts by our stockholders to replace or remove our current management
- 65Our restated certificate of incorporation and amended and restated bylaws contain exclusive forum provisions for certain claims, which may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or team members
- 66Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the regulations promulgated thereunder
- 67We may be adversely affected by natural disasters, pandemics and other catastrophic events, and by man-made problems such as acts of war, terrorism, that could disrupt our business operations and our business continuity and disaster recovery plans may not adequately protect us from a serious disaster
- 68We are and could continue to be subject to securities class action litigation and shareholder derivative suits
Other GitLab 10-Ks
- FY2026 10-K risk factors71 risks11 new8 dropped17 reworded
AI risks now emphasize regulation, copyright, personal-data compliance, and litigation involving GitLab Duo.
Filed Mar 17, 2026
About this page
The headings are the filing's own. The one-line readings and the overview are automated and can be wrong: read Item 1A of the 10-K for the exact wording.